%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\documentstyle[12pt,twoside,alltt,psfig]{article}
\textwidth=6in
\oddsidemargin=0.25in
\evensidemargin=0.25in
\topmargin=-0.1in
\footskip=0.8in
\parindent=0.0cm
\parskip=0.3cm
\textheight=8.00in
\setcounter{tocdepth} {3}
\setcounter{secnumdepth} {2}
\sloppy

\newenvironment{proof}{\noindent{\bf Proof:}}{\qed\bigskip}
\newenvironment{proof_sketch}{\noindent{\bf Sketch of 
Proof}\hspace*{1em}}{\qed\bigskip}

\newtheorem{theorem}{Theorem}
\newtheorem{corollary}{Corollary}
\newtheorem{lemma}{Lemma}
\newtheorem{claim}{Claim}
\newtheorem{fact}{Fact}
\newtheorem{definition}{Definition}
\newtheorem{assumption}{Assumption}
\newtheorem{observation}{Observation}
\newtheorem{example}{Example}
\newcommand{\qed}{\rule{7pt}{7pt}}

\newcommand{\lecture}[4]{
\pagestyle{headings}
\thispagestyle{plain}
\newpage
\noindent
\begin{center}
\framebox{
\vbox{
\hbox to 5.75in { {\bf 6.857 Computer and Network Security
\hfill Fall Term, 1996}  }
\vspace{4mm}
\hbox to 5.75in { {\Large \hfill Lecture #1 : #2 \hfill} }
\vspace{2mm}
\hbox to 5.75in { {\it Lecturer: #3 \hfill Scribe: #4} }
}
}
\end{center}
\markboth{Lecture #1 : #2}{Lecture #1 : #2}
\vspace*{4mm}
}

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Lecture command takes 4 arguments:
%		ordinal number of the lecure
%		date of the lecure
%		lecturer
%		scribe---that is you
%
\lecture{25}{December 5, 1996}{Ron Rivest}{Kenneth Pang} 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% For theorems, lemmas, definitions, remarks, etc. use commands
% \begin{theorem} .... \end{theorem} 
% \begin{definition} ... \end{definition} 
% \begin{proof} ... \end{proof}
% and so on ...
%
% If you want to insert figures in your notes do the following: 
% 1) Prepare your figures using your favourite graphic editor
% 	for example idraw or xfig
% 2) Save your pictures in PostScript form using the following convention
% 	notes-nn-fig-mm.ps where nn is the number of the lecture you 
% 	are scribing and mm is the sequential number of the picture in the 
% 	notes
% 3) Insert the following block in your LaTeX code in the place you 
% 	want to insert the figure BUT LEAVE IT AS A COMMENT (with the %
% 	at the beginning of the line) since it will not work on athena: 
%
% \begin{figure}[h]
% \begin{center}
% \mbox{\psfig{figure=notes-nn-fig-mm.ps}}
% \caption{A very nice picture.}
% \label{fig:mm}
% \end{center}
% \end{figure}
%
% 	of course the picture will not show up when you compile and 
% 	print your notes, but don't worry the TA will take care of it. 
% 4) When you mail the TA the LaTeX code mail him/her the PostScript
%	files for the figures as well 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes start here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\section{Outline}

In this lecture we will discuss the following topics:

\begin{itemize}
\item Worm
\item TCP/IP
\item Firewalls
\end{itemize}

\section{The Internet Worm}

In November of 1988, a self propagating worm was released onto the
ARPANET.  Known as the Internet Worm, it didn't physically attach itself
to other programs, but instead 'attached' itself to the computer system.
It was created by Robert Morse Jr., the son of a well known computer
security expert.  A bug which prevented the worm from always checking to
tell if a host was infected, caused the worm to overload the host
computers it infected.  

\subsection{How it worked}
The worm obtained a new target machine name from the host it had just
infected.  It then attempted to get a shell program running on the
target machine.  This shell program served as a beach head and was used
to down load several binary files.  The virus used several means to get
the shell program running.  In particular, it exploited a bug in the
sendmail routine (a debug option was left enabled in the program
release), along with a bug in the 'finger' routine. 

These binary executables were used to crack passwords via a common
password dictionary and the system dictionary.  The virus then attacked
a new set of target hosts using any cracked accounts it may have
obtained from the current host.  

\subsection{Ramifications and Lessons Learned}
The virus was not malicious.  It did not harm any of the data on the
systems it infected.  Due to a flaw in its design, it overloaded the
host machines, otherwise it may have never been detected!  Robert Morse
Jr.'s crime was that he abused system resources that were not his.  What
kind of punishment should he be charged with? 

Many valuable lessons came out of the Internet Worm. The following list
is just a brief summary. 

\begin{itemize}
\item Least Privilege
\item Beware of insider attacks
\item Diversity in systems is good
\item The cure should not be worse than the disease
\item Defenses should be erected at the host and not the network level
\item Denial of service attacks are easy! 
\end{itemize}

\section{Internet Protocol (IP)}

IP host addresses are 32 bits long (though soon they will be 128
bits). Every machine  on the Internet has a host address. There are also
different classes of addresses:

\begin{tabbing}
:sssssssssssssssssss \= ssssssssssssssss                \= \kill
Class C              \> 110 $\overbrace{network}^{21}$  \> $\overbrace{host}^8$ \\
Class B              \> 10 $\overbrace{network}^{14}$   \> $\overbrace{host}^{16}$ \\
Class A              \> 0 $\overbrace{network}^7$       \> $\overbrace{host}^{24}$ \\
\end{tabbing}

Routing on the Internet is supported by:

\begin{enumerate}
\item {\em Routing Tables}. Each machine maintains various routing
tables that enable it to figure out the destination of packets that come
by. One security problem with routing tables is that they can be
manipulated. If this happens, packets can be diverted >from their proper
course by an adversary. 

\item {\em Domain Name Service (DNS)}. DNS translates symbolic names to
numerical ones, and vice versa e.g {\em theory.lcs.mit.edu} to {\em
Numerical Address}. 
\end{enumerate}

\section{Transfer Control Protocol (TCP)}

Packets going across the Internet have a source machine and a
destination machine. There are various protocols implemented for
transferring these packets. These include {\em ICMP  (Internet Control
Message Protocol)}, {\em UDP (User Datagram Protocol)} and {\em TCP
(Transfer Control Protocol)}. TCP is the one of most interest to users. 

\subsection{Ports}

There are port numbers associated with the different network
services. Port numbers below 1024 are usually the standard services
(mail, ftp etc), whereas those above 1024 are for user-oriented
services. Some typical port numbers and their corresponding  service for
TCP are:

\begin{tabbing}
:ssssssssssssssssssssss \= ssssssss \= \kill
Port 79                 \> -        \> finger \\
Port 80                 \> -        \> http \\
Port 25                 \> -        \> smtp (mail) \\
Port 6000               \> -        \> X11 (X windows) \\
Ports 20, 21            \> -        \> ftp \\
\end{tabbing}

A typical packet has the following attributes:

Type: TCP \\
From: Source IP address \\
From: Source port number \\
To: Destination IP address \\
To: Destination port number \\

These packets are not authenticated in any way. 

\subsection{Source routing}

Packet routers try to find the shortest route for a packet that is going
by. This means that sometimes a packet can be forced to take  particular
route. One implication of this is that an eavesdropper may be able to
force packets to go by a certain machine, or to appear as though they
are coming from a certain machine. However, this can also be used in a
beneficial way, for example, to avoid potential problem areas, or
untrusted parts of the network. 

\section{Firewalls}

There are different approaches to making a computer system secure from
attacks from the Internet. One is to try to make sure that all of the
computers are secure, i.e.  to make sure that users pick secure
passwords, to apply security patches, etc. However, this is usually hard
to do. 

Another approach is to install a monitor or gateway, separating the
internal network from the Internet. This is called a {\em firewall} (see
figure 1). All communications between the Internet and the internal
network must go through the firewall, which does a security check on
them. The internal machines may be maintained casually, but the firewall
will have very strict security codes. Firewalls are also useful for
keeping lots of transactions between the Internet and the network, which
could be used for intrusion detection. The usual policy for a firewall
is {\em ``Everything not expressly permitted is  prohibited.''} 

\begin{figure}[h]
\begin{center}
\mbox{\psfig{figure=notes-25-fig-1.ps}}
\caption{A firewall sits between the internal network and the Internet.} 
\label{fig:1}
\end{center}
\end{figure}

Firewalls have certain limitations. They cannot tell much about the
content of the messages that are passing by, especially if they are
encrypted. They are not useful for detecting, for example, if members of
the internal network are leaking out corporate secrets. However, they
can be very useful. Cheswick and Bellovin at AT\&T claim that a firewall
prevented the Internet worm from getting into their system. 

\section{Packet Filtering}

Firewalls usually have to deal with TCP or UDP packges. First we examine
a typical  TCP/IP session, and then see how a firewall might use packet
filtering to limit the Internet access of an internal network. 

Figure 2 shows a typical TCP session. Port 80 is used, which means that
this is an HTTP connection. 

\begin{figure}[h]
\begin{center}
\mbox{\psfig{figure=notes-25-fig-2.ps}}
\caption{A typical TCP connection.} 
\label{fig:2}
\end{center}
\end{figure}

In the diagram: \\
1000 is a randomly generated sequence number \\
SYN means ``synchronization'' \\
ACK means ``acknowledgement'' \\
FIN means ``finish'' \\

A firewall needs to decide whcih parts of the transaction it will allow,
disallow, or modify. 

\subsection{Example Packet Filter}

Suppose a system wants to support email (and nothing else) between the
Internal network and the Internet. Th packet filter can be made to only
allow packets related to  email to go through (note that there is still
a potential security problem since some mail programs have bugs and can
be used for other purposes e.g to execute shell commands). 

A packet filter may have the following rule set:

\begin{tabbing}
:sssssssssssss \= sssssssssssss \= sssssssssssss \= sssssssssssss \= sssssssssssss \= sssssssssssss \= \kill
FROM     \> ACTION    \> SOURCE    \> PORT    \> DEST   \> PORT   \> FLAGS \\
A        \> Allow     \> Our Hosts \> *       \> *      \> 25 \\
\end{tabbing}

``FROM A'' refers to the link A between the internal network and the
firewall (see figure 1).  It should be noted that it is not {\em
guaranteed} that port 25 is for mail, though this is {\em usually} the
case. 

So far, this rule would allow the first packet i.e SYN(1000). To allow
more access we add the following rules:

\begin{tabbing}
:sssssssssssss \= sssssssssssss \= sssssssssssss \= sssssssssssss \= sssssssssssss \= sssssssssssss \= \kill
FROM     \> ACTION   \> SOURCE    \> PORT    \> DEST   \> PORT   \> FLAGS \\
Ch B     \> Allow    \> *         \> 25      \> *      \> *      \> ACK \\
Ch A     \> Allow    \> Our Hosts \> *       \> *      \> 25     \> ACK \\
\end{tabbing}

We need to consider whether these three rules allow email access as well
as provide security from both inside and outside attacks. 

One possible attack is {\em tunneling}. The firewall can be defeated if
there is a cooperating pair, one on the inside of the system, and one on
the ouside (on the Internet). The outside party can make requests on
behalf of the inside one, e.g make a web request and then send it back
to the inside user as email (to port 25). This is effectively giving the
inside user web access. 

\subsection{A More Complicated Packet Filtering Example}

Suppose the system also wants to allow ftp access to its users. Ftp uses
two ports, one for control, and one for file transfer. Figure 3 shows a
typical ftp session. 

\begin{figure}[h]
\begin{center}
\mbox{\psfig{figure=notes-25-fig-3.ps}}
\caption{A typical TCP ftp connection.} 
\label{fig:3}
\end{center}
\end{figure}

The danger here is that port X (usually a number greater than 1024) is
opened from  the outside. However, this can be switched around, and the
ftp server can be requested not to open the connection, but allow the
user to. This is what a packet filter would require. Figure 4 shows this
sort of ftp connection. 

\begin{figure}[h]
\begin{center}
\mbox{\psfig{figure=notes-25-fig-4.ps}} 
\caption{A passive TCP ftp connection.} 
\label{fig:4}
\end{center}
\end{figure}

There is still a potential security problem with the ftp connection. The
internal users have the capability of connecting to any random port Y on
the outside. Y may not necessarily be an ftp port number (e.g it could
be a number greater than 1024). So users may be able to get access other
than ftp. 

\section{Application-Level Gateways}

Packet level filters have their limitations. An application level
approach to filtering  allows the contents of the packets to be examined
in more detail. This is a more  sophisticated way of doing filtering,
and applies more intelligence to the system.  Figure 5 shows a possible
set up for this, with a bastion host sitting between two packet filters. 

\begin{figure}[h]
\begin{center}
\mbox{\psfig{figure=notes-25-fig-5.ps}}
\caption{Using a bastion host.} 
\label{fig:5}
\end{center}
\end{figure}

The bastion host understand the various Internet protocols (e.g ftp,
http) better than the packet filters, and can be used to enforce a more
sophisticated security policy. It has a host address both in reference
to the Internet and in reference to the internal network.  The bastion
host can be used to implement an application-level gateway. Most
sophisticated systems tend to have this combination of bastion host and
packet filters. The bastion host can also be used to log connection
attempts. 

The following protocols are examined to see how an application gateway
might be useful:

{\bf Gopher}. Gopher supports UUencoding, in that it takes UUencoded
files from the Internet. Some gopher programs copy the files in with the
same permission bits as the original, which can pose security
problems. The intelligence to recognize a UUencoded file can be placed
in the bastion host, which can automatically disallow them. 

{\bf Telnet}. The bastion host can decide which other hosts can be
connected to.  The bastion host can also control the rate of data
transmission of the telnet connection. 

{\bf WWW}. A firewall could be placed in a school so that no adult
material is allowed in.  The bastion host will need to understand
labels. An application gateway might also be able to rewrite anchors so
that url requests come back to it. 

Another example is the use of {\em TCP wrappers}. These log connection
attempts, then run off the request process. They can also do things like
automatically fingering the machine that is sending the request, to find
out who is logged on. 

There is currently a library of tools for implementing firewalls, called
TIS. 

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes end here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\end{document}



